The release of Deloitte Private’s second report in its Family Business Insights Series: Family Business Cybersecurity, 2025 examines how family businesses are addressing one of the most pressing challenges of the digital era: cyber threats. Based on a survey of 1,587 family businesses across 35 countries and in-depth interviews with 30 senior executives, the research explores how family businesses with revenue of at least US$100 million are building resilience amid an increasingly complex cyber landscape.

Key Takeaways

• Nearly three-quarters (74%) of family businesses globally experienced at least one cyberattack in the past two years; 33% faced multiple incidents

• Nearly half (43%) report having a robust cybersecurity strategy; most rely on basic defenses such as software updates (59%) and multifactor authentication (57%)

• Family businesses affected by attacks reported financial (54%), operational (51%), or reputational (51%) damage; just 4% reported no resulting damage

“Cybersecurity has become one of the most urgent issues facing family enterprises today,” says Adrian Batty Deloitte Private Global Family Enterprise Leader, Deloitte Global.

“Deloitte Private’s latest Family Business Insights Series report reveals how these organizations are balancing tradition with transformation, protecting not just their data, but the legacy and trust that define them. The findings offer a blueprint for building lasting cyber resilience in an increasingly complex digital world.”

Cyber Threats Are Becoming More Frequent And Complex

In a continuously connected business environment, family businesses are facing more cyber threats. Nearly three in four (74%) family businesses globally have faced at least one cyberattack in the past two years, with one-third (33%) reporting two or more incidents. These attacks take many forms, including malware (49%), phishing or business email compromise (48%), and social engineering (43%).

While cyber threats are universal, regions face different levels of exposure. Asia Pacific-based respondents reported the highest frequency of cyberattacks within the last two years (90%), followed by North America (76%), Europe and the Middle East (both at 67%), Africa (64%), and South America (61%). This disparity reflects not only exposure and digitalization across regions, but also variations in breach reporting, regulatory environments, and cyber resilience maturity.

Moving Beyond Basic Defenses To Strengthen Resilience

Many respondents understand the gravity of cyber risk, with nearly 70% viewing cyber threats as a moderate (44%) or high (25%) risk. However, only 52% of family business feel prepared “to a large extent” to safeguard their businesses against cyberattacks, while the remaining 48% do not feel at all prepared or only feel prepared to a small or moderate extent.

While most family businesses have taken initial steps to protect their operations, many remain reliant on basic cyber hygiene rather than comprehensive resilience strategies. While 43% of family businesses report having a robust cybersecurity strategy with no known weaknesses, the majority of respondents (57%) indicated they either have gaps in their strategy (49%) or no strategy at all (8%). Most rely on foundational “first-line” protections, such as software updates (59%), network security (57%), and multifactor authentication (57%), while fewer have adopted advanced safeguards like cyber maturity assessments (36%) or incident response playbooks (40%).

Cyber Can Help Protect Legacies And Safeguard Trust

Family businesses increasingly face significant losses or damage due to cyberattacks. Only 4% of those surveyed reported no loss or damage from such attacks. The majority of those targeted have experienced financial losses (54%), operational disruptions (51%), and reputational harm (51%). In response, many businesses are strengthening their governance practices, upgrading their systems, and investing in new capabilities.

To address cyber challenges, family business should consider the following leading practices:

• Position cybersecurity as a business imperative

• Perform ongoing cyber maturity reviews

• Fortify core and advanced protections

• Build workforce awareness and manage insider threat risk

• Establish and test response and recovery procedures

• Tap expert and peer networks within cybersecurity

• Strengthen vendor and supply chain resilience

• Keep track of regulatory shifts

“In an increasingly digital world, the challenges that family businesses face today are multidimensional,” says Dr. Rebecca Gooch, Deloitte Private Global Head of Insights, Deloitte Global.

“Every click, connection, and collaboration carries potential risk and opportunity."

"The path forward for family enterprises requires treating cybersecurity not as a cost, but as a strategic investment in resilience, reputation, and the continuity of the legacy they’ve spent generations building.”

About Family business cybersecurity, 2025

The global Family business cybersecurity, 2025 report is the second edition in Deloitte Private’s Family Business Insights Series. To inform this research, Deloitte Private surveyed 1,587 family-owned businesses worldwide between March and June 2025, each having a minimum revenue of US$100 million. The report also includes in-depth interviews with 30 senior executives from prominent family businesses, offering qualitative insights into the strategies and practices that drive long-term success.

For more information or to access the full report, please visit Deloitte Private’s website here

About Deloitte

Deloitte refers to one or more of Deloitte Touche Tohmatsu Limited (DTTL), its global network of member firms, and their related entities (collectively, the “Deloitte organization”). DTTL (also referred to as “Deloitte Global”) and each of its member firms and related entities are legally separate and independent entities, which cannot obligate or bind each other in respect of third parties. DTTL and each DTTL member firm and related entity is liable only for its own acts and omissions, and not those of each other. DTTL does not provide services to clients. Please see www.deloitte.com/about to learn more.

Deloitte provides leading professional services to nearly 90% of the Fortune Global 500® and thousands of private companies. Our people deliver measurable and lasting results that help reinforce public trust in capital markets and enable clients to transform and thrive. Building on its 180-year history, Deloitte spans more than 150 countries and territories. Learn how Deloitte’s approximately 460,000 people worldwide make an impact that matters at www.deloitte.com.